@maycombhq/atticus 0.0.0-stage → 2.0.0-beta.10

package/dist/chunk-PIVKU64W.js

@@ -0,0 +1,688 @@
+import { createRequire as __atticusCreateRequire } from "node:module";
+import { fileURLToPath as __atticusFileURLToPath } from "node:url";
+var require = __atticusCreateRequire(import.meta.url);
+var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
+var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
+import {
+  checkResult,
+  fileStepStore,
+  recordStep
+} from "./chunk-NGPU2ARF.js";
+import {
+  ExecutorsFile,
+  IdempotencyAnswer,
+  PingResponse,
+  RunProgress,
+  RunResult,
+  SECRET_KEY_PATTERN,
+  external_exports,
+  loadOrgPack,
+  orgPackDirOf,
+  require_dist,
+  secretKeys
+} from "./chunk-577AJVRS.js";
+import {
+  __toESM
+} from "./chunk-TV45EUGM.js";
+
+// packages/executors/dist/run.js
+var import_yaml = __toESM(require_dist(), 1);
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+
+// packages/executors/dist/transports.js
+import { spawn } from "node:child_process";
+var TransportError = class extends Error {
+  kind;
+  constructor(kind, message) {
+    super(message);
+    this.kind = kind;
+    this.name = "TransportError";
+  }
+};
+function cleanEnv(env = process.env) {
+  return Object.fromEntries(Object.entries(env).filter(([k]) => !SECRET_KEY_PATTERN.test(k)));
+}
+var LOCAL = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
+function isLocalUrl(url) {
+  try {
+    return LOCAL.has(new URL(url).hostname);
+  } catch {
+    return false;
+  }
+}
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+function httpClient(cfg, o = {}) {
+  const base = cfg.url.replace(/\/+$/, "");
+  const call = async (path, init = {}, timeoutMs = cfg.timeoutMs) => {
+    const ac = new AbortController();
+    const t = setTimeout(() => ac.abort(), timeoutMs);
+    try {
+      const res = await fetch(`${base}${path}`, { ...init, signal: ac.signal });
+      const text = await res.text();
+      let body;
+      try {
+        body = text ? JSON.parse(text) : void 0;
+      } catch {
+        throw new TransportError("protocol", `${cfg.name} answered ${path} with something that isn't JSON`);
+      }
+      return { status: res.status, body };
+    } catch (e) {
+      if (e instanceof TransportError)
+        throw e;
+      if (e.name === "AbortError")
+        throw new TransportError("timed-out", `${cfg.name} didn't answer ${path} within ${timeoutMs} ms`);
+      throw new TransportError("unreachable", `${cfg.name} can't be reached at ${base}: ${e.message}`);
+    } finally {
+      clearTimeout(t);
+    }
+  };
+  return {
+    async ping() {
+      const r = await call("/ping", {}, Math.min(cfg.timeoutMs, 5e3));
+      return PingResponse.parse(r.body);
+    },
+    async check(key) {
+      const r = await call(`/idempotency/${encodeURIComponent(key)}`);
+      if (r.status === 404)
+        return void 0;
+      return IdempotencyAnswer.parse(r.body);
+    },
+    async run(request, onProgress) {
+      const deadline = Date.now() + cfg.timeoutMs;
+      const started = await call("/run", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(request)
+      });
+      const done = RunResult.safeParse(started.body);
+      if (started.status === 200 && done.success)
+        return done.data;
+      if (started.status !== 202 && started.status !== 200)
+        throw new TransportError("protocol", `${cfg.name} refused the run (HTTP ${started.status})`);
+      const runId = started.body?.runId ?? request.runId;
+      let seen = 0;
+      for (; ; ) {
+        const left = deadline - Date.now();
+        if (left <= 0)
+          throw new TransportError("timed-out", `${cfg.name} didn't finish within ${cfg.timeoutMs} ms`);
+        const r = await call(`/runs/${encodeURIComponent(runId)}`, {}, left);
+        const b = r.body ?? {};
+        for (const p of (b.progress ?? []).slice(seen)) {
+          const pp = RunProgress.safeParse(p);
+          if (pp.success)
+            onProgress?.(pp.data);
+        }
+        seen = b.progress?.length ?? seen;
+        if (b.result)
+          return RunResult.parse(b.result);
+        await sleep(Math.min(o.pollMs ?? 50, Math.max(1, deadline - Date.now())));
+      }
+    }
+  };
+}
+function exchange(cfg, line, onLine, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    let child;
+    try {
+      child = spawn(cfg.command, cfg.args, {
+        env: cleanEnv(),
+        stdio: ["pipe", "pipe", "pipe"],
+        windowsHide: true
+      });
+    } catch (e) {
+      reject(new TransportError("unreachable", `${cfg.name} can't be started: ${e.message}`));
+      return;
+    }
+    let buf = "";
+    let finished = false;
+    const finish = (err) => {
+      if (finished)
+        return;
+      finished = true;
+      clearTimeout(timer);
+      child.kill();
+      if (err)
+        reject(err);
+      else
+        resolve();
+    };
+    const timer = setTimeout(() => finish(new TransportError("timed-out", `${cfg.name} didn't finish within ${timeoutMs} ms`)), timeoutMs);
+    child.on("error", (e) => finish(new TransportError("unreachable", `${cfg.name} can't be started: ${e.message}`)));
+    child.stdout.setEncoding("utf8");
+    child.stdout.on("data", (chunk) => {
+      buf += chunk;
+      let i;
+      while ((i = buf.indexOf("\n")) >= 0) {
+        const l = buf.slice(0, i).trim();
+        buf = buf.slice(i + 1);
+        if (!l)
+          continue;
+        let msg;
+        try {
+          msg = JSON.parse(l);
+        } catch {
+          continue;
+        }
+        try {
+          if (onLine(msg))
+            finish();
+        } catch (e) {
+          finish(e);
+        }
+      }
+    });
+    child.on("close", (code) => finish(new TransportError("protocol", `${cfg.name} exited (code ${code}) before answering`)));
+    child.stdin.on("error", () => void 0);
+    child.stdin.end(`${JSON.stringify(line)}
+`);
+  });
+}
+function commandClient(cfg) {
+  return {
+    async ping() {
+      let pong;
+      await exchange(cfg, { type: "ping" }, (m) => {
+        if (m.type !== "pong")
+          return false;
+        pong = PingResponse.parse(m);
+        return true;
+      }, Math.min(cfg.timeoutMs, 1e4));
+      return pong;
+    },
+    async check(key) {
+      let ans;
+      await exchange(cfg, { type: "check", idempotencyKey: key }, (m) => {
+        if (m.type !== "checked")
+          return false;
+        ans = IdempotencyAnswer.parse(m);
+        return true;
+      }, cfg.timeoutMs);
+      return ans;
+    },
+    async run(request, onProgress) {
+      let result;
+      await exchange(cfg, request, (m) => {
+        if (m.type === "progress") {
+          const p = RunProgress.safeParse(m);
+          if (p.success)
+            onProgress?.(p.data);
+          return false;
+        }
+        if (m.type !== "result")
+          return false;
+        result = RunResult.parse(m);
+        return true;
+      }, cfg.timeoutMs);
+      return result;
+    }
+  };
+}
+var MCP_PROTOCOL_VERSION = "2025-06-18";
+var IDEMPOTENCY_TOOL = "atticus_check_idempotency";
+function toolName(cfg, procedure, step) {
+  return cfg.tools[`${procedure}/${step}`] ?? `${procedure}_${step}`.replace(/[^A-Za-z0-9_-]/g, "_");
+}
+async function mcpSession(cfg, timeoutMs, work) {
+  let child;
+  try {
+    child = spawn(cfg.command, cfg.args, {
+      env: cleanEnv(),
+      stdio: ["pipe", "pipe", "pipe"],
+      windowsHide: true
+    });
+  } catch (e) {
+    throw new TransportError("unreachable", `${cfg.name} can't be started: ${e.message}`);
+  }
+  const pending = /* @__PURE__ */ new Map();
+  let listener;
+  let next = 1;
+  let buf = "";
+  let dead;
+  const failAll = (e) => {
+    dead ??= e;
+    for (const p of pending.values())
+      p.reject(e);
+    pending.clear();
+  };
+  child.on("error", (e) => failAll(new TransportError("unreachable", `${cfg.name} can't be started: ${e.message}`)));
+  child.on("close", (code) => failAll(new TransportError("protocol", `${cfg.name} exited (code ${code})`)));
+  child.stdin.on("error", () => void 0);
+  child.stdout.setEncoding("utf8");
+  child.stdout.on("data", (chunk) => {
+    buf += chunk;
+    let i;
+    while ((i = buf.indexOf("\n")) >= 0) {
+      const l = buf.slice(0, i).trim();
+      buf = buf.slice(i + 1);
+      if (!l)
+        continue;
+      let m;
+      try {
+        m = JSON.parse(l);
+      } catch {
+        continue;
+      }
+      if (typeof m.id === "number" && pending.has(m.id)) {
+        const p = pending.get(m.id);
+        pending.delete(m.id);
+        if (m.error)
+          p.reject(new TransportError("protocol", `${cfg.name}: ${m.error.message ?? "error"}`));
+        else
+          p.resolve(m.result);
+      } else if (typeof m.method === "string")
+        listener?.(m);
+    }
+  });
+  const send = (msg) => child.stdin.write(`${JSON.stringify(msg)}
+`);
+  const rpc = (method, params) => new Promise((resolve, reject) => {
+    if (dead)
+      return reject(dead);
+    const id = next++;
+    pending.set(id, { resolve, reject });
+    send({ jsonrpc: "2.0", id, method, ...params !== void 0 ? { params } : {} });
+  });
+  let timer;
+  const timeout = new Promise((_r, reject) => {
+    timer = setTimeout(() => reject(new TransportError("timed-out", `${cfg.name} didn't finish within ${timeoutMs} ms`)), timeoutMs);
+  });
+  try {
+    return await Promise.race([
+      (async () => {
+        await rpc("initialize", {
+          protocolVersion: MCP_PROTOCOL_VERSION,
+          capabilities: {},
+          clientInfo: { name: "atticus", version: "0.0.1" }
+        });
+        send({ jsonrpc: "2.0", method: "notifications/initialized" });
+        return work(rpc, (fn) => listener = fn);
+      })(),
+      timeout
+    ]);
+  } finally {
+    clearTimeout(timer);
+    child.stdin.end();
+    child.kill();
+  }
+}
+var ToolList = (v) => (v?.tools ?? []).map((t) => t.name);
+function resultOf(raw, runId) {
+  const r = raw ?? {};
+  let data = r.structuredContent;
+  if (data === void 0) {
+    const text = r.content?.find((c) => c.type === "text")?.text;
+    try {
+      data = text ? JSON.parse(text) : {};
+    } catch {
+      data = { message: text };
+    }
+  }
+  const d = data ?? {};
+  return RunResult.parse({
+    type: "result",
+    runId,
+    status: r.isError ? "failed" : d.status ?? "done",
+    outputs: d.outputs ?? {},
+    evidence: d.evidence ?? [],
+    ...typeof d.message === "string" ? { message: d.message } : {}
+  });
+}
+function mcpClient(cfg) {
+  const reverse = new Map(Object.entries(cfg.tools).map(([k, v]) => [v, k]));
+  return {
+    async ping() {
+      return mcpSession(cfg, Math.min(cfg.timeoutMs, 1e4), async (rpc) => {
+        const tools = ToolList(await rpc("tools/list")).filter((t) => t !== IDEMPOTENCY_TOOL);
+        return PingResponse.parse({
+          type: "pong",
+          name: cfg.name,
+          version: "mcp",
+          procedures: tools.map((t) => reverse.get(t) ?? t),
+          fillOnly: cfg.fillOnly
+        });
+      });
+    },
+    async check(key) {
+      return mcpSession(cfg, cfg.timeoutMs, async (rpc) => {
+        if (!ToolList(await rpc("tools/list")).includes(IDEMPOTENCY_TOOL))
+          return void 0;
+        const r = resultOf(await rpc("tools/call", { name: IDEMPOTENCY_TOOL, arguments: { idempotencyKey: key } }), "check");
+        return { type: "checked", idempotencyKey: key, used: r.outputs.used !== false };
+      });
+    },
+    async run(request, onProgress) {
+      return mcpSession(cfg, cfg.timeoutMs, async (rpc, notes) => {
+        const name = toolName(cfg, request.procedure, request.step);
+        if (!ToolList(await rpc("tools/list")).includes(name))
+          throw new TransportError("protocol", `${cfg.name} has no tool ${name} for ${request.procedure}/${request.step}`);
+        notes((m) => {
+          if (m.method !== "notifications/progress")
+            return;
+          const p = m.params ?? {};
+          if (p.progressToken !== request.runId || !p.message)
+            return;
+          onProgress?.({
+            type: "progress",
+            runId: request.runId,
+            message: p.message,
+            ...typeof p.progress === "number" && p.total ? { percent: Math.min(100, p.progress / p.total * 100) } : {}
+          });
+        });
+        const { inputs, ...meta } = request;
+        const raw = await rpc("tools/call", {
+          name,
+          arguments: inputs,
+          _meta: { progressToken: request.runId, atticus: meta }
+        });
+        return resultOf(raw, request.runId);
+      });
+    }
+  };
+}
+function clientFor(cfg) {
+  if (cfg.transport === "http")
+    return httpClient(cfg);
+  if (cfg.transport === "command")
+    return commandClient(cfg);
+  return mcpClient(cfg);
+}
+
+// packages/executors/dist/run.js
+var EXECUTORS_FILE = ".atticus/executors.yaml";
+var ExecutorError = class extends Error {
+  code;
+  problems;
+  constructor(code, message, problems = []) {
+    super(message);
+    this.code = code;
+    this.problems = problems;
+    this.name = "ExecutorError";
+  }
+};
+async function loadExecutors(root, file = join(root, EXECUTORS_FILE)) {
+  let text;
+  try {
+    text = await readFile(file, "utf8");
+  } catch {
+    return { executors: [], problems: [] };
+  }
+  try {
+    const r = ExecutorsFile.safeParse((0, import_yaml.parse)(text));
+    if (r.success)
+      return { executors: r.data.executors, problems: [] };
+    return {
+      executors: [],
+      problems: r.error.issues.map((i) => `${EXECUTORS_FILE}: ${i.path.join(".")}: ${i.message}`)
+    };
+  } catch (e) {
+    return {
+      executors: [],
+      problems: [`${EXECUTORS_FILE}: invalid YAML: ${e.message.split("\n")[0]}`]
+    };
+  }
+}
+function canonicalJson(v) {
+  if (Array.isArray(v))
+    return `[${v.map(canonicalJson).join(",")}]`;
+  if (v && typeof v === "object")
+    return `{${Object.keys(v).sort().filter((k) => v[k] !== void 0).map((k) => `${JSON.stringify(k)}:${canonicalJson(v[k])}`).join(",")}}`;
+  return JSON.stringify(v);
+}
+var inputsSha256 = (inputs) => createHash("sha256").update(canonicalJson(inputs), "utf8").digest("hex");
+var idempotencyKey = (step) => createHash("sha256").update(`${step.id}
+${canonicalJson(step.inputs)}`, "utf8").digest("hex").slice(0, 32);
+function schemaProblems(schema, value, what) {
+  let s;
+  try {
+    s = external_exports.fromJSONSchema(schema);
+  } catch {
+    const required = schema.required ?? [];
+    return required.filter((k) => value?.[k] === void 0).map((k) => `${what}: ${k} is required`);
+  }
+  const r = s.safeParse(value);
+  return r.success ? [] : r.error.issues.map((i) => `${what}${i.path.length ? `.${i.path.join(".")}` : ""}: ${i.message}`);
+}
+var nowIso = () => (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d{3}Z$/, "Z");
+function preflight(step, procedure, executor, o) {
+  if (step.state !== "open")
+    return { refused: `Step ${step.id} is already ${step.state}.` };
+  if (!step.procedure || !step.procedureStep)
+    return {
+      refused: `Step ${step.id} names no procedure, so no executor can run it; do it yourself.`
+    };
+  if (!procedure)
+    return { refused: `The org pack has no procedure ${step.procedure}.` };
+  const stepDef = procedure.steps.find((s) => s.id === step.procedureStep);
+  if (!stepDef)
+    return { refused: `Procedure ${procedure.id} has no step ${step.procedureStep}.` };
+  if (procedure.status === "retired")
+    return { refused: `Procedure ${procedure.id} is retired.` };
+  if (!procedure.executors.allowed.includes(o.name))
+    return {
+      refused: `Executors are off unless the org pack allows them: process/procedures/${procedure.id}.yaml doesn't list ${o.name} under executors.allowed.`
+    };
+  if (!executor)
+    return { refused: `${o.name} isn't in ${EXECUTORS_FILE}.` };
+  if (executor.transport === "http" && !isLocalUrl(executor.url)) {
+    const host = new URL(executor.url).hostname;
+    if (!procedure.executors.remoteHosts.includes(host))
+      return {
+        refused: `${o.name} is at ${host}, not on this machine; the org pack doesn't allow that host for ${procedure.id}.`
+      };
+  }
+  const declared = executor.procedures.length + executor.stepKinds.length > 0;
+  if (declared && !executor.procedures.includes(procedure.id) && !executor.procedures.includes(`${procedure.id}/${stepDef.id}`) && !executor.stepKinds.includes(stepDef.kind))
+    return { refused: `${o.name} doesn't say it can run ${procedure.id}/${stepDef.id}.` };
+  if (o.fillOnly && !executor.fillOnly)
+    return { refused: `${o.name} can't fill a form without submitting it.` };
+  const sha = inputsSha256(step.inputs);
+  if (stepDef.writes) {
+    if (!o.approval)
+      return {
+        refused: `Step ${step.id} writes to ${step.system}: approve this run with its exact inputs (sha-256 ${sha}).`
+      };
+    if (o.approval.inputsSha256 !== sha)
+      return {
+        refused: `The approval doesn't cover these inputs: it is for ${o.approval.inputsSha256 ?? "no inputs"}, the step's inputs are ${sha}. Approve again.`
+      };
+    if (o.approval.ref !== step.id)
+      return { refused: `The approval is for ${o.approval.ref}, not step ${step.id}.` };
+  }
+  const secrets = secretKeys(step.inputs);
+  if (secrets.length)
+    return {
+      refused: `The inputs hold what looks like a credential (${secrets.join(", ")}); executors never get credentials.`
+    };
+  return { stepDef, problems: schemaProblems(stepDef.inputs, step.inputs, "inputs") };
+}
+async function runStep(root, stepId, o) {
+  const store = o.store ?? fileStepStore(root);
+  let step = await store.get(stepId);
+  if (!step)
+    throw new ExecutorError("not-found", `There is no step ${stepId}.`);
+  const procedures = o.procedures ?? (await loadOrgPack(join(orgPackDirOf(root)))).procedures;
+  if (!step.procedure && step.state === "open") {
+    const s = step;
+    const found = procedures.find((p) => p.status !== "retired" && (p.template ? p.template === s.inputs.template : p.system === s.system) && p.steps.some((x) => x.kind === s.action));
+    if (found)
+      step = await store.save({
+        ...s,
+        procedure: found.id,
+        procedureStep: found.steps.find((x) => x.kind === s.action).id
+      });
+  }
+  const executors = o.executors ?? (await loadExecutors(root)).executors;
+  const procedure = procedures.find((p) => p.id === step.procedure);
+  const executor = executors.find((e) => e.name === o.executor);
+  const pre = preflight(step, procedure, executor, {
+    name: o.executor,
+    ...o.approval ? { approval: o.approval } : {},
+    ...o.fillOnly ? { fillOnly: true } : {}
+  });
+  if ("refused" in pre)
+    throw new ExecutorError("refused", pre.refused);
+  if (pre.problems.length)
+    throw new ExecutorError("invalid", `Step ${step.id}'s inputs don't fit procedure ${procedure.id}.`, pre.problems);
+  const now = o.now ?? nowIso;
+  const key = idempotencyKey(step);
+  const client = o.client ?? clientFor(executor);
+  const approval = o.approval ?? { by: step.createdBy, at: now(), ref: step.id };
+  const earlier = step.runs.filter((r) => r.idempotencyKey === key && r.status !== "refused");
+  const last = earlier.at(-1);
+  if (last && pre.stepDef.writes && last.approval.at >= approval.at) {
+    const unused = await client.check(key).then((a) => a?.used === false, () => false);
+    if (!unused)
+      throw new ExecutorError("refused", `Step ${step.id} already ran with ${last.executor} (${last.status}); it may have gone through. Check the outside system, then approve a new run.`);
+  }
+  const runId = `${step.id}-${step.runs.length + 1}`;
+  const mode = o.fillOnly ? "fill-only" : "submit";
+  const base = {
+    runId,
+    executor: o.executor,
+    at: now(),
+    approval,
+    mode,
+    idempotencyKey: key
+  };
+  let result;
+  let status;
+  let message;
+  try {
+    result = await client.run({
+      schemaVersion: 1,
+      type: "run",
+      runId,
+      procedure: procedure.id,
+      step: pre.stepDef.id,
+      inputs: step.inputs,
+      ...step.change ? { change: step.change } : {},
+      manualStep: step.id,
+      idempotencyKey: key,
+      mode,
+      ...pre.stepDef.writes ? { approval } : {}
+    }, o.onProgress);
+    status = result.status;
+    message = result.message ?? "";
+  } catch (e) {
+    if (e instanceof TransportError) {
+      status = e.kind === "timed-out" ? "timed-out" : e.kind === "unreachable" ? "unreachable" : "failed";
+      message = e.message;
+    } else if (e instanceof external_exports.ZodError) {
+      status = "failed";
+      message = `${o.executor} answered something that isn't a valid result: ${e.issues.map((i) => i.message).join("; ")}`;
+    } else
+      throw e;
+  }
+  let outputs;
+  if (result && status === "done") {
+    outputs = result.outputs;
+    const problems = [
+      ...schemaProblems(pre.stepDef.outputs, outputs, "outputs"),
+      ...checkResult(step, Object.fromEntries(Object.entries(outputs).filter(([k]) => step.result.some((f) => f.name === k)))).problems
+    ];
+    if (problems.length) {
+      status = "failed";
+      message = `${o.executor}'s outputs don't fit the step: ${problems.join("; ")}`;
+    }
+  }
+  const run = { ...base, status, finishedAt: now(), ...message ? { message } : {} };
+  const saved = await store.save({ ...step, runs: [...step.runs, run] });
+  if (status === "done" && outputs) {
+    const closed = await recordStep(store, step.id, {
+      by: approval.by,
+      at: now(),
+      values: Object.fromEntries(Object.entries(outputs).filter(([k]) => step.result.some((f) => f.name === k))),
+      via: "executor",
+      executor: o.executor,
+      evidence: result?.evidence ?? [],
+      note: `Done by ${o.executor}, approved by ${approval.by}.`
+    });
+    return {
+      step: closed,
+      run,
+      status,
+      outputs,
+      message: `${o.executor} did step ${step.id}.`,
+      fallback: false
+    };
+  }
+  const why = status === "needs-person" ? `${o.executor} stopped and a person finishes step ${step.id}${message ? `: ${message.replace(/[.]+$/, "")}` : ""}.` : `${o.executor} didn't finish step ${step.id} (${status}${message ? `: ${message}` : ""}). The step stays open: do it yourself, or approve a new run.`;
+  return {
+    step: saved,
+    run,
+    status,
+    ...outputs ? { outputs } : {},
+    message: why,
+    fallback: true
+  };
+}
+
+// packages/executors/dist/check.js
+import { join as join2 } from "node:path";
+async function executorsCheck(root, o = {}) {
+  const loaded = o.executors ? { executors: o.executors, problems: [] } : await loadExecutors(root);
+  const procedures = o.procedures ?? (await loadOrgPack(join2(orgPackDirOf(root)))).procedures;
+  const out = [];
+  for (const cfg of loaded.executors) {
+    const allowedFor = procedures.filter((p) => p.executors.allowed.includes(cfg.name)).map((p) => p.id);
+    const where = cfg.transport === "http" ? cfg.url : [cfg.command, ...cfg.args].join(" ");
+    const base = {
+      name: cfg.name,
+      transport: cfg.transport,
+      where,
+      fillOnly: cfg.fillOnly,
+      allowedFor
+    };
+    if (cfg.transport === "http" && !isLocalUrl(cfg.url)) {
+      const host = new URL(cfg.url).hostname;
+      const ok = procedures.some((p) => p.executors.remoteHosts.includes(host));
+      if (!ok) {
+        out.push({
+          ...base,
+          reachable: false,
+          covers: cfg.procedures,
+          problem: `${host} isn't this machine and no procedure allows it; it isn't pinged.`
+        });
+        continue;
+      }
+    }
+    try {
+      const pong = await (o.client ?? clientFor)(cfg).ping();
+      out.push({
+        ...base,
+        reachable: true,
+        version: pong.version,
+        fillOnly: cfg.fillOnly || pong.fillOnly,
+        covers: [
+          .../* @__PURE__ */ new Set([...pong.procedures, ...pong.stepKinds, ...cfg.procedures, ...cfg.stepKinds])
+        ].sort()
+      });
+    } catch (e) {
+      out.push({
+        ...base,
+        reachable: false,
+        covers: [...cfg.procedures, ...cfg.stepKinds],
+        problem: e instanceof TransportError ? e.message : `${cfg.name}: ${e.message}`
+      });
+    }
+  }
+  const names = new Set(loaded.executors.map((e) => e.name));
+  const missing = procedures.flatMap((p) => p.executors.allowed.filter((n) => !names.has(n)).map((n) => ({ procedure: p.id, executor: n })));
+  return { executors: out, missing, problems: loaded.problems };
+}
+
+// packages/executors/dist/reference.js
+import { fileURLToPath } from "node:url";
+var __atticus_import_meta_url = __atticusUrl("packages/executors/dist/reference.js");
+var REFERENCE_EXECUTOR = fileURLToPath(new URL("../reference/reference-executor.mjs", __atticus_import_meta_url));
+
+export {
+  clientFor,
+  ExecutorError,
+  loadExecutors,
+  inputsSha256,
+  runStep,
+  executorsCheck
+};